QUME · Policy and compliance
Know every device is compliant, control by control
A policy is not a document that describes an intention. It is compiled into a bundle, signed, delivered as desired state, applied by the agent and read back control by control, so the console shows what the device is, not what it was told.
- A policy is compiled once, not once per device.
- It becomes one signed bundle per cohort: the devices whose effective policy resolves the same way.
- Every device in a cohort takes that same bundle and reads its controls back, so the estate size does not change the work.
Capabilities
What QUME does for policy and compliance
Per-control verdicts, with unknown kept separate
Every control reports compliant, non-compliant or unknown, and unknown carries its reason: no such control on this platform, the agent could not read it, or the device has stopped reporting.
Device, group and organisation merge
Effective policy resolves in a stated order, and the console can show which layer set a control and why the others lost.
Staged rollouts with halt conditions
Cohorts advance from canary to group to organisation to fleet, and a wave halts on the reported health of the devices that already took it rather than on a timer.
Offline grace, then consequence
A device out of contact gets a stated grace period and is then restricted. Both thresholds are policy, and the evaluator fails closed when its window cannot be read.
Location and sites
Wi-Fi BSSID, source IP and GPS are ranked by what they prove rather than by precision. Sites carry a time zone, so a maintenance window opens when the site expects it.
Anti-rollback on desired state
An older bundle with a valid signature is refused. Replaying a correctly signed artefact is the attack that signature checking alone does not stop.
In the console
And in day-to-day use
A remediation ladder
Out-of-policy devices move from notify to restrict, quarantine and wipe on rules you set, with every step recorded.
Configuration and browser policies
A configuration library and browser policies managed beside device policy, compiled and read back the same way.
Quarantine policies
Decide in advance what a quarantined device may still reach, so containment never needs improvising.
Questions
What buyers ask
How do we know a setting really applied?
The agent reads each control back after applying it. The console shows the device’s actual state, control by control.
Can we test a policy before it reaches everyone?
Yes. Rollouts start with a canary cohort and halt by themselves when the devices that took it report problems.
See policy and compliance in QUME
On your own devices, with your team.